Loading story…
Apple released security updates for CVE-2026-86950, an out-of-bounds write vulnerability in CoreGraphics that can enable arbitrary code execution when a victim processes a maliciously crafted file. Apple said it is aware of reports that the issue may have been used in an “extremely sophisticated” targeted attack against specific individuals running iOS versions before iOS 27; it did not disclose the attackers, victim count, compromise details, or timing.
The company fixed the flaw with improved bounds checking in iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1, and credited Meta Product Security with reporting it. Organizations should prioritize deployment across supported Apple endpoints, particularly devices remaining on pre-iOS 27 releases, because exploitation requires only user processing of a malicious file and could result in full confidentiality, integrity, and availability impact.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Calif reported that WhatsApp 26.38.74 added Kaleidoscope checks for malformed, undecodable, or unverified embedded PDF fonts, with each condition halting automatic parsing as high risk. Calif described this only as indirect evidence of a possible CVE-2026-86950 delivery path and did not demonstrate WhatsApp-based delivery or identify real-world exploit samples.
Calif researchers Dion Blazakis, Josh Maine, and Anna Groza published a public proof of concept for CVE-2026-86950 using a crafted PDF with an embedded TrueType font. It crashes unpatched iOS and macOS devices and demonstrates a controlled out-of-bounds write primitive, but does not demonstrate code execution or establish an in-the-wild delivery vector.
CISA added CVE-2026-86950, an Apple CoreGraphics out-of-bounds write vulnerability that may permit arbitrary code execution, to its Known Exploited Vulnerabilities Catalog. It directed affected federal civilian agencies to apply Apple mitigations and complete required forensic triage; known ransomware use was listed as unknown.
Apple released iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1 to remediate an out-of-bounds write in CoreGraphics that could permit arbitrary code execution when processing a maliciously crafted file. Apple credited Meta Product Security for reporting the issue and said it may have been exploited in an extremely sophisticated attack targeting specific individuals using iOS versions prior to iOS 27.
Apple fixed CVE-2026-86869 in iOS 27, iPadOS 27, and macOS 27. ironPeak said the flaw could be triggered by a malicious iMessage without user interaction and bypass BlastDoor; Apple credited ironPeak researcher Niels Hofmans and Meta researchers, while exploitation before patching has not been confirmed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
47 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcesecurityaffairs.com
Open sourcemkd-cirt.mk
Open sourcethehackernews.com
Open sourcecert.pa
Open sourcedeveloper.apple.com
Open sourceengineering.fb.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple released security updates to address an **actively exploited zero-day** tracked as **CVE-2026-20700**, warning it may have been used in an “extremely sophisticated” attack targeting specific individuals on versions of iOS prior to *iOS 26*. The flaw affects **`dyld` (Apple’s dynamic linker)** and can allow **arbitrary code execution** when an attacker already has **memory write** capability; reporting attributes discovery to **Google’s Threat Analysis Group** and notes it may have been used as part of an exploit chain. Apple shipped fixes across its ecosystem, including *iOS 26.3*, *iPadOS 26.3*, *macOS Tahoe 26.3*, *watchOS 26.3*, *tvOS 26.3*, and *visionOS 26.3*. The same reporting indicates Apple also issued patches tied to the broader report for **CVE-2025-14174** (an out-of-bounds memory access issue in Chrome’s **ANGLE** graphics component on Mac) and **CVE-2025-43529** (a **use-after-free** leading to code execution), and commentary from security practitioners emphasized that enterprise risk is driven by **patch deployment speed**—particularly where updates rely on end users rather than enforced device management.
Jun 29, 2026
Apple released security updates for **CVE-2026-20700**, a **zero-day** in `dyld` (the Dynamic Link Editor) that can enable **arbitrary code execution** when an attacker already has a memory-write capability. Apple said it is aware the issue “may have been exploited” in **extremely sophisticated, targeted attacks** against specific individuals, and credited **Google Threat Analysis Group (TAG)** with discovery. Apple also linked the same incident reporting to two earlier vulnerabilities (**CVE-2025-14174** and **CVE-2025-43529**) that were previously addressed. The fixes were shipped across Apple’s ecosystem, including **iOS/iPadOS**, **macOS** (including *macOS Tahoe*), **tvOS**, **watchOS**, and **visionOS**; impacted device families include iPhone 11 and later and multiple iPad generations, as well as Macs running *macOS Tahoe*. Canadian Centre for Cyber Security guidance echoed Apple’s warning of potential exploitation and urged rapid patching (e.g., **iOS/iPadOS 18.7.5** and **26.3** releases for newer OS lines). Other vendor advisories published in the same period (HPE, Chrome, Intel, Fortinet, Siemens, Dell, CISA ICS, IBM, Red Hat) are unrelated to the Apple zero-day and reflect routine multi-vendor patch activity rather than the specific exploitation event.
Jun 29, 2026
Apple issued annual security updates across its operating systems, patching **261 vulnerabilities**—its largest annual remediation total reported to date. The fixes span the Kernel, WebKit, SMB, CUPS, ImageIO, SceneKit, Disk Images, and privacy and sandboxing services. Documented impacts include arbitrary code execution, root or kernel privilege escalation, memory disclosure and corruption, sandbox escapes, Gatekeeper and privacy-control bypasses, data exposure, and denial of service through malicious web content and files, network shares and servers, accessories, or local applications. iOS 27 fixes more than 100 vulnerabilities, while the security-only iOS 26.7 update fixes more than 80, including 75 issues shared with iOS 27; this gives organizations deferring the iOS 27 upgrade a path to remediate many of the same risks. Notable issues include a kernel flaw through which a malicious application could obtain root privileges and a Bluetooth flaw that could permit remote code execution. Apple also released macOS Tahoe 26.7 and macOS Sequoia 15.8 for systems remaining on older macOS versions. No vulnerabilities are known to be actively exploited, but published technical details heighten exposure for unpatched devices; Apple credited Anthropic Claude for three fixes and recognized OpenAI Codex Security.
Sep 17, 2026